Not trying to scare anyone, I just keep running into the same stuff over and over.
People ship something on Lovable, Bolt or v0 in a weekend (respect for that) and then nobody looks at what's exposed once it's live. Things I've seen on people's own projects:
API keys sitting right there in the JS bundle
Supabase or Firebase rules left wide open
an /admin route with no auth because "nobody knows the url"
old staging subdomains still running months later
What's the worst thing you found on your own project after launch? Curious if it's the same patterns or if I'm missing some.
Full disclosure, I'm one of the cofounders of Xseth and this is pretty much what we look at all day, so I'm happy to share what we check for if anyone wants a list to go through on their own site.
People ship something on Lovable, Bolt or v0 in a weekend (respect for that) and then nobody looks at what's exposed once it's live. Things I've seen on people's own projects:
API keys sitting right there in the JS bundle
Supabase or Firebase rules left wide open
an /admin route with no auth because "nobody knows the url"
old staging subdomains still running months later
What's the worst thing you found on your own project after launch? Curious if it's the same patterns or if I'm missing some.
Full disclosure, I'm one of the cofounders of Xseth and this is pretty much what we look at all day, so I'm happy to share what we check for if anyone wants a list to go through on their own site.